Ok, so I have this friend, and hes having some virus troubles. He was on MSN, and he got a folder that had nothing in it, and he had downloaded it. Now, he thought there were pics in it, but, as I said, there was nothing inside. After he downloaded it... it got bigger the longer it was in there, and he can't delete it. When he deleted it, the file got bigger.

He has Norton, and I have AVG free. I haven't had a virus in like, 2 years, and that was when I had an old email that was all bugged up. He needs some help. He says the file is absorbing KBs as time passes, and if left alone, it'll eventually get big enough to eat his entire comp!

Seriously, he needs help

Certainly sounds serious. But if antivirus isn't detecting it, might it not be some kind of temp file? I'm simply guessing. A temp file that is being added to but not erased.

Antiviruses can be bypassed these days, it involves destroying part of the native windows file protection and loading a spetial driver at startup. I just had to reinstall everything after I got hit with a rootkit trojan, although using a trojan to plant a virus seems like a complete waste of the effort. I mean you would rather have control of the machine to use for DOS attacks and such, right.

Little more detail: what happens when he tries to scan the folder with Norton? Can it be scanned at all? Does Norton just freeze? Does Norton think there's nothing wrong with it? Does it try to kill it but the folder 'gets bigger'?

 

Can he move the folder? Rename? Put things inside it?

As long the name of the file isn't pagefile.sys...

 

By "folder", do you mean archive? I.e. did he extract something from e.g. a zip file?

 

Sounds like it is time to try some other scanners. There are quite a few free on-line scanners.

Either way, feel for you.

i wonder if this is a virus or a warez folder. maybe the "folder" put a back door in so people can get in and UL/DL warez files if they have the proper username/password. your friend should take himself off the 'net to see if it continues to grow.

 

taks

i wonder if this is a virus or a warez folder. maybe the "folder" put a back door in so people can get in and UL/DL warez files if they have the proper username/password. your friend should take himself off the 'net to see if it continues to grow.

 

taks

 

I see what you mean. Seems like a damn good idea.

Ok. I learned about this online the Team Gizka forum. here is the thread:

http://forums.team-gizka.org/viewtopic.php?f=4&t=3165

Sounds very much like a trojan that turns your computer into a distribution node.

Sounds very much like a trojan that turns your computer into a distribution node.

Drop a picture of goatse, tubgirl and lemonparty into it and see if the activity stops.

Better yet. Drop a key-logger like WinGuardian into it. See if one of the techies here can make it self executing and email the results to some free addy like hotmail or some-such.

Better yet. Drop a key-logger like WinGuardian into it. See if one of the techies here can make it self executing and email the results to some free addy like hotmail or some-such.

You mean you don't have one handy?

Better yet. Drop a key-logger like WinGuardian into it. See if one of the techies here can make it self executing and email the results to some free addy like hotmail or some-such.

You mean you don't have one handy?

I do have WinGuardian. That's why I suggested it as a possible bit of amusement. It is a key-logger that also records what web-sites you visit, copies of your e-mail received and sent as well as all the key commands you give your system and the internal files that you visit. It must be installed locally though. I just don't know how to make it self-executing. You set it up on a system and it'll e-mail the results directly to your inbox as often as you wish.

 

Might be kinda fun don't you think?

You spying on your wife or something ?

You spying on your wife or something ?

Naw, I bought it along with a bunch of other software as a novelty. Spybot will catch it BTW.

I just don't know how to make it self-executing.

 

I know it is possible, but I cannot remember how - I'll ask a programmer I know and see if she knows a quick way to do that.

This would give me the heebie jeebies. It'd be like when I had rats in the ceiling.